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95 (54) TOle: METHOD FOR REDUCING THE SPREAD OF COMPUTER VIRUSES IN AN ELECTRONIC MAIL NETWORK 

(57) Abstract: The invention relates to a method for reducing the spread of computer viruses in an electronic mail netwoik. In a 
mail server having a multiplicity of connected email subscriber computers, a method is installed which is used to test emails sent in 
succession to the subscribers or sent in succession by the subscribeis for particular commonalities, and, depending on commonalities 
established, either to forward the emails automatically as intended or to retain them until another criterion arises. 
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Method for reducing the spread of coxnputer viruses in an 
j electronic mail network 

The invention relates to a method for reducing the spread 
5 of computer viruses in an electronic mail network. 

Prior art 

In today' s age of electronic mails and world-wide 
10 networking of computers, many forms of so-called computer 
viruses constitute great danger for companies operating 
their networked computers with connections to the 
electronic outside world as well. At the points of 
connection to the electronic outside world, such as the 
15 Internet, special computers are operated as so-called 
firewalls which, amongst other things, attempt to filter 
out emails containing electronic viruses externally 
^before they can reach the companies' own computers. A- 
virus is recognized by special software which, in each 
20 case, needs to be kept at the level of the latest virus 
patterns by the manufacturer. 

However, between the appearance of a new virus and the 
creation and spread of a new virus pattern, a certain 

25 time elapses in which the virus can cause considerable 
damage. The method of virus recognition in the firewall 
computer is thus fundamentally susceptible. This is 
because, to produce a virus pattern, it is first 
necessary to recognize a virus, which is usually already 

30 connected to an instance of damage. If a virus is sent by 
the originator and is widely introduced into company 
networks at the same time, then damage limitation becomes 
a race against the time between the spread of the virus 
and the creation and installation of recognition 

35 programs. Particular structures mean that the virus can 
cause considerable damage within a few hours, which are 
required to create a recognition pattern, by causing the 
affected computers to send copies of itself to all the 
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email addresses stored in this computer in snowball 
fashion, for example. 

Invention 

5 

The aim of this invention is to limit or interrupt the 
snowball-like forwarding chain of the virus. 

The invention is achieved by means of the features 
10 specified in Claim 1. 

Advantageous developments can be found in the dependent 
claims . 

15 According to the invention, in a mail server having a 
multiplicity of connected email subscriber computers, a 
method is installed which is used to test emails sent in 
succession to the subscribers or sent in succession by 
the subscribers for particular commonalities, and, 

20 depending on commonalities established, either to forward 
the emails automatically as intended or to retain them 
until another criterion arises. 

The criterion which can be selected for the commonality 
25 established is the occurrence of the same subject line in 
a plurality of emails, the occurrence of the same text 
content, of an attachment which is the same, and/or the 
same or similarly timed sending or reception time. 

30 If an electronic mail is automatically retained on 
account of one or more of these criteria, the mail server 
can forward an email query to the sending email 
subscriber to determine whether he actually wants to send 
all emails provided with substantial commonalities, and 

35 this sending email subscriber responds to this with an 
explicit acknowledgement. 
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Preferably, the entry of an identifier or of a password 
can be used as an ^^explicit acknowledgement" from the 
sending email subscriber. 

5 An alternative or a further, ^Mifferent criterion" may be 
an email query with the administrator of the network in 
question to determine whether he actually wants all 
emails provided with substantial commonalities to be 
sent, and this administrator responds to this with an 
10 explicit acknowledgement. 



Preferably, such characterized electronic mails may also 
be forwarded after a delay time has elapsed. The time 
delay should then advantageously be large enough for it 
15 to be possible to react to a virus warning externally, or 
should fall into a prescribed time frame, for example 
into the normal working time of the administrator. 
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Patent claims 



Method for reducing the spread of computer viruses 
in an electronic mail network, having a mail server 
and a multiplicity of email subscriber computers 
connected thereto, by emails sent in succession to 
the subscribers or sent in succession by the 
subscribers, characterized in that the emails sent 
in succession to the subscribers or sent in 
succession by the subscribers are tested for 
particular commonalities and, depending on 
commonalities established, the electronic emails are 
either automatically forwarded as intended or are 
retained until another criterion arises. 

Method according to Claim 1, characterized in that 
the criterion used for the commonality established 
is the occurrence of the same subject line in a 
plurality of emails, the occurrence of the same text 
content, of an attachment which is the same, and/or 
the same or similarly timed sending or reception 
time. 



Method according to Claim 1, characterized in that, 
if an electronic mail is automatically retained on 
account of one or more of these criteria, the mail 
server forwards an email query to the sending email 
subscriber. 



Method according to Claim 3, characterized in that 
these emails provided with substantial commonalities 
are sent by the mail server if the sending email 
subscriber acknowledges the email query by the email 
server with an explicit acknowledgement. 

Method according to Claim 4, characterized in that 
the entry of an identifier or of a password is 
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preferably used as an ^'explicit acknowledgement'' 
from the sending email siabscriber. 

6, Method according to Claim 1, characterized in that, 
5 as a further, different criterion, an email query is 

sent to the administrator of the network in question 
to determine whether he actually wants all emails 
provided with substantial commonalities to be sent, 
and this administrator responds to this with an 
10 explicit acknowledgement* 



1 . Method according to Claim 1, characterized in that 
such characterized electronic mails are forwarded 
after a delay time has elapsed* 

15 

8. Method according to Claim 7, characterized in that 
the time delay falls into a prescribed time frame, 
preferably into the normal working time of the 
administrator . 
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